Invisable file technology for recovering or protecting a computer file system

• US 20030115458A1
• Filed: 12/19/2001
• Published: 06/19/2003
• Est. Priority Date: 12/19/2001
• Status: Abandoned Application

• Current Assignee: Softonnet
• Original Assignee: Softonnet
• Inventors: Song, Dongho
• Application Number:
  US10/028,046
• Publication Number:
  US 20030115458A1
• Time in Patent Office: Days
• US Class Current: 713/165
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect

Abstract

Invisible file technology is used for protection and recovery of a file system. In particular, a selection of one or more items to be included in a safety zone is received. A system call that may affect an item in the safety zone is intercepted. If the system call affects an item in the safety zone, the system call is processed to avoid permanent modification of the item. In particular, the invisible file technology provides data protection by altogether preventing certain modifications to the file system and, in some cases, provides recovery for a file system of a computer by returning the file system to its original form when there are unwanted modifications.

Claims

1. A system for protecting a file system of a computer, comprising:

an interface operable to receive a selection of an item of the file system to be included in a safety zone;

a memory in communication with the interface and operable to store information relating to the item; and

a processor in communication with the memory and operable to intercept a system call which potentially could affect the item in the safety zone, and to process the system call to avoid permanent modification of the item.

2. The system of claim 1, wherein the processor is operable to examine a composition, information structure, and normal status of the file system.

3. The system of claim 1, wherein the processor is operable to cause the computer to only boot from a hard disk drive of the computer.

4. The system of claim 1, wherein the safety zone comprises at least one of a file system, a drive, a directory, a file, or a registry for the computer.

5. The system of claim 1, wherein the interface is operable to present information about the safety zone.

6. The system of claim 1, wherein the processor is operable to present a user of the computer with an impression that the system call was executed even when the system call actually has not been executed.

7. The system of claim 1, wherein the processor is operable to make the item transparent to a user of the computer.

8. A method of protecting and recovering a file system in a computer, comprising the steps of:

storing file system information obtained from examining an operating system and a file system structure in the computer;

setting a safety zone based on selection of a target that is to be protected or recovered, wherein selection is made in response to input by an authenticated administrator;

receiving a system call referencing a file pathname corresponding to the target;

analyzing the system call to determine if the system call affects the target; and

if said system call may affect the target, performing processing to avoid permanent modification of the target.

9. The method of claim 8, wherein performing processing comprises creating a copy of the target.

10. The method of claim 8, wherein performing processing comprises making the target transparent to a user of the computer.

11. The method of claim 8, wherein performing processing comprises making the system call void.

12. The method of claim 8, comprising verifying a booting media for the computer to prevent use of abnormal booting media.

13. The method of claim 12, wherein the abnormal booting media comprises a floppy disk or a CD-ROM drive.

14. The method of claim 8, further comprising examining a composition, information structure, and normal status of the file system.

15. The method of claim 8, wherein the stored file system information comprises original file system information, and further comprising:

comparing the original file system information with current file system information; and

replacing the original file system information with the current file system information if the original file system information and the current file system information are not identical.

16. The method of claim 8, wherein the target comprises at least one of a file system, a drive, a directory, a file, or a registry of the computer.

17. The method of claim 8, wherein the system call is for creating a target and wherein performing processing comprises:

creating the target; and

updating current file system information to show that the target has been created.

18. The method of claim 8, wherein the system call is for deleting a target and wherein performing processing comprises:

when the target has not already been deleted,

copying the target for recovery; and

updating current file system information to show that the target has been deleted.

19. The method of claim 18, further comprising:

when the target has already been deleted, voiding the system call.

20. The method of claim 8, wherein the system call is for renaming a target and wherein performing processing comprises:

when the target has not already been renamed,

copying the target for recovery; and

updating current file system information to show that the target has been renamed.

21. The method of claim 20, wherein the system call is for renaming a target and wherein performing processing comprises:

when the target has already been renamed, voiding the system call.

22. The method of claim 8, wherein the system call comprises searching for a target and further comprising:

searching for the target using the current file system information.

23. The method of claim 22, further comprises:

searching for the target if the target is marked with renew, rename, or delete.

24. The method of claim 8, further comprising:

recovering the target.

25. The method of claim 24, wherein the target is recovered by comparing the stored file system information to current file system information.

26. The method of claim 24, wherein the target is recovered by renaming a stored copy of the target.

27. The method of claim 8, wherein performing processing comprises preventing access to the target.

28. The method of claim 8, wherein the system call is for an interrupt and wherein processing further comprises:

voiding the system call if processing the interrupt would affect partition information of the file system.

29. A method of protecting and recovering a file system of a computer comprising:

receiving a selection of an item to be included in a safety zone;

intercepting a system call which potentially could affect the item in the safety zone; and

performing processing responsive to the system call so that the item is not permanently modified.

30. The method of claim 29, further comprising updating file system information on a data storage device coupled to the computer with file system information from a disk drive coupled to the computer.

31. The method of claim 29, wherein performing processing comprises voiding the system call.

32. The method of claim 31, wherein performing processing comprises providing a user of the computer with an impression that the system call was executed.

33. The method of claim 29, wherein performing processing comprises:

determining that the system call is a find file request; and

if execution of the find file request would access an item in a safety zone,

performing the find file request without accessing the file system.

34. The method of claim 29, wherein performing processing comprises making a copy of the item.

35. The method of claim 29, wherein performing processing comprises making the item transparent to a user of the computer.

36. The method of claim 29, wherein performing processing comprises making the system call void.

37. The method of claim 29, comprising verifying a booting media for the computer to prevent use of abnormal booting media.

38. The method of claim 29, further comprising storing original file system information.

39. The method of claim 38, further comprising:

comparing the stored original file system information with current file system information; and

replacing the original file system information with the current file system information if the original file system information and the current file system information are not identical.

40. The method of claim 29, wherein the item comprises at least one of a file system, a drive, a directory, a file, or a registry of the computer.

41. The method of claim 29, wherein the system call is for creating an item and wherein performing processing comprises:

creating the item; and

updating current file system information to show that the item has been created.

42. The method of claim 29, wherein the system call is for deleting an item and wherein performing processing comprises:

when the item has not already been deleted,

copying the item for recovery; and

updating current file system information to show that the item has been deleted.

43. The method of claim 42, further comprising:

when the item has already been deleted, voiding the system call.

44. The method of claim 29, wherein the system call is for renaming an item and wherein performing processing comprises:

when the item has not already been renamed,

copying the item for recovery; and

updating current file system information to show that the item has been renamed.

45. The method of claim 44, wherein the system call is for renaming an item and wherein performing processing comprises:

when the item has already been renamed, voiding the system call.

46. The method of claim 29, wherein the system call comprises searching for an item and further comprising:

searching for the item using the current file system information.

47. The method of claim 46, further comprises:

searching for the item if the item is marked with renew, rename, or delete.

48. The method of claim 29, wherein performing processing comprises recovering items in the safety zone.

49. The method of claim 48, wherein recovering occurs periodically.

50. The method of claim 48, wherein recovering occurs upon reboot.

51. The method of claim 48, wherein the item is recovered by comparing the stored file system information to current file system information.

52. The method of claim 48, wherein the item is recovered by renaming a stored copy of the item.

53. The method of claim 29, wherein performing processing comprises preventing access to the item.

54. The method of claim 29, wherein the system call is for an interrupt and wherein processing further comprises:

voiding the system call if processing the interrupt would affect partition information of the file system.

55. A method of protecting and recovering a file system of a computer comprising:

receiving a selection of an item to be included in a safety zone from an administrator;

intercepting a system call received from a user which potentially could affect the item in the safety zone; and

performing processing responsive to the system call so that the item is not permanently modified.

56. The method of claim 55, further comprising:

authenticating the administrator.

57. The method of claim 56, further comprising:

receiving authorization information from the administrator; and

comparing the received authorization information to stored authorization information to determine whether to authenticate the administrator.

58. The method of claim 55, wherein the item is a first item, further comprising:

receiving a selection of a second item to be included in an open zone from an administrator.

59. The method of claim 58, wherein the second item may be permanently modified.

60. The method of claim 58, wherein the item is a first item, further comprising:

receiving a selection of a second item to be protected from an administrator.

61. The method of claim 60, further comprising:

restricting user access to the second item.

62. The method of claim 55, wherein the item is stored as an original item, and wherein performing processing comprises:

creating a copy of the original item;

storing the copy for recovery; and

allowing a user to access the original item.

63. The method of claim 55, wherein performing processing comprises making the item transparent to a user of the computer.

64. The method of claim 55, wherein performing processing comprises making the system call void.

65. A computer-readable storage medium storing a computer program executable by one or more computers, the computer program comprising computer instructions for:

receiving a selection of an item to be included in a safety zone;

intercepting a system call which potentially could affect the item in the safety zone; and

performing processing responsive to the system call so that the item is not permanently modified.

66. The computer-readable storage medium method of claim 65, wherein performing processing further comprises instructions for voiding the system call.

67. The computer-readable storage medium method of claim 66, wherein performing processing further comprises providing instructions for providing a user of the computer with an impression that the system call was executed.

68. The computer-readable storage medium method of claim 65, wherein performing processing further comprises instructions for:

determining that the system call is a find file request; and

if execution of the find file request would access an item in a safety zone,

performing the find file request without accessing the file system.

69. The computer-readable storage medium method of claim 65, further comprising instructions for verifying a booting media for the computer to prevent use of abnormal booting media.

70. The computer-readable storage medium method of claim 65, further comprising instructions for:

storing original file system information;

at a later time, comparing the stored original file system information with current file system information; and

replacing the original file system information with the current file system information if the original file system information and the current file system information are not identical.

71. The computer-readable storage medium method of claim 65, wherein the system call is for creating an item and wherein performing processing further comprises instructions for:

creating the item; and

updating current file system information to show that the item has been created.

72. The computer-readable storage medium method of claim 65, wherein the system call is for deleting an item and wherein performing processing further comprises instructions for:

when the item has not already been deleted,

copying the item for recovery; and

updating current file system information to show that the item has been deleted.

73. The computer-readable storage medium method of claim 65, wherein the system call is for renaming an item and wherein performing processing further comprises instructions for:

when the item has not already been renamed,

copying the item for recovery; and

updating current file system information to show that the item has been renamed.

74. The computer-readable storage medium method of claim 65, further comprising instructions for recovering items in the safety zone.

75. The computer-readable storage medium method of claim 74, wherein the item is recovered by renaming a stored copy of the item.

76. The computer-readable storage medium method of claim 65, wherein performing processing further comprises instructions for preventing access to the item.

77. The computer-readable storage medium method of claim 65, wherein the system call is for an interrupt and wherein processing further comprises instructions for:

voiding the system call if processing the interrupt would affect partition information of the file system.